**1. Introduction of the Study**

Internal transport represents a well-known occupational hazard in many modern industrial environments. Pallet movers (synonyms for 'pallet mover' are pallet jack, walkie-rider, pallet truck, transpallet) are used for internal transport in several industries, and these machines are easy to operate, compared to, for example, forklift trucks. However, pallet movers are inherently dangerous machines. They often operate close to pedestrian workers and, charged with a load, their total mass can be well above two tons. Often, their load is not secured to the machine, leading to instability when gravity gets a grip of the load.

The company under investigation in this study is a manufacturing plant located in Belgium, which is part of an American multinational, producing consumer products all over the world. Pallet movers are used frequently for internal transport. Like many major American companies, this company also pays a lot of attention to the safety of their employees. The company uses the so-called 6W-2H and why-why techniques to analyze its recordable accidents without or with lost work time. The 6W-2H problem analysis produces a description of the context of accidents (what, where, which, when, who, to whom, how, how much). The why-why analysis is performed to get to the so-called root causes of accidents and is based on mapping of what happened during the accident process and why this happened. Countermeasures are formulated based on the results of these accident analyzes. The entire accident analysis is the responsibility of the supervisors, but are hereby supported by the Health and Safety (HSEQ) staff.

According to figures provided by the European safety manager of the abovementioned multinational, the 6W-2H and why-why techniques did not help in reducing occupational accidents substantially. As an alternative, a bow-tie analysis is proposed, providing a detailed and comprehensive insight into potential accident scenarios, including possible safety barriers (both technical and non-technical) and management delivery systems which can prevent or mitigate the accident processes. In Section 4, the choice for the bow-tie method is supported.

To test the bow-tie analysis, a pilot project was formulated, focussing on accidents during internal transport with pallet movers. Accidents with pallet movers represent a significant share of the total number of accidents. In the years 2015 and 2016, about ten percent of all recordable accidents with lost work time that occurred at the European plants of the multinational involved a pallet mover.

The research question of this study is 'Which accident scenarios are possible during internal transport with pallet movers and which safety barriers (both technical as organizational and human) and management delivery systems can influence (i.e., prevent or mitigate) these accident scenarios?'.

#### **2. Background of the Plant under Investigation**

At the Belgian plant, approximately 300 people are employed. Two out of three employees are permanent ('own company employees') and one out of three is a contractor.

The production process is manifested on several floors. The upper floors are responsible for supplying raw materials, the production of intermediate products, and supplying these intermediate products to lower floors, where product finishing and packing take place. The ground floor has production lines for finishing the products and packing lines. These lines are implanted in an existing space which was initially not designed for that purpose.

The entire plant is characterized by a lot of load manipulation, which means that products are stocked in many temporary buffers. For example, on the ground floor, the packing materials are transported from the warehouse to a first large buffer (by a forklift truck), followed by transportation from the first large buffer to a second smaller buffer (by a pallet mover), and from the second smaller buffer to a buffer in front of the production or packing line (by a pallet mover).

The transportation routes of forklift trucks are separated from transportation routes of pallet movers, leading to (almost) no possible contact between the two types of internal transport.

Figure 1 shows two types of pallet movers being used at the plant: Standard electrical pallet movers and electrical stackers which can lift loads to approximately 1.8 m. Pallet movers can transport a load of 1.2 to 2 tons, have a driving speed up to 6 km/h and a standard emergency stop. Maintenance and repair of pallet movers are performed by the company itself on a regular basis, while inspections are performed by an external company every three months.

Approximately 75% of the operators handling pallet movers are provided by one steady contractor company. The contractor staff is characterized by a frequent rotation.

Figure 2 shows the most frequent loads transported at the plant. Finished products are not transported with pallet movers, only raw materials, intermediate products, packing material, and off-quality products.

During the period from 2015 to 2016, eight recordable accidents occurred at the Belgian location. In three of these accidents, a pallet mover was involved. Two of these pallet mover accidents happened with a contractor employee, and one with a company employee.

**Figure 1.** The types of pallet movers—(**a**): standard pallet mover and (**b**): stacker.

**Figure 2.** The most frequent loads transported with pallet movers.

#### **3. Research Methodology**

To compose the bow-ties of accidents with pallet movers, a multi-method design was used.

A literature search was conducted using electronic databases of the library of the Delft University of Technology, the British Health and Safety Executive (HSE), the American Occupational safety and Health Administration (OSHA), and the American National Institute for Occupational Safety and Health (NIOSH). Search terms were the following: 'pallet mover', 'pallet jack', 'walkie-rider', 'pallet truck, 'transpallet', and 'accident'. Safety related articles on pallet movers were rather scarce in the literature. Therefore, articles on forklift truck accidents (using the search term 'forklift') were also included in the literature study, for as far as the accident processes had similarities with the ones of pallet movers.

Belgian and Dutch national data on pallet mover accidents were requested. For Belgium, data on pallet mover accidents are obtained from Fedris, the Belgian federal agency for occupational risks. For The Netherlands, Storybuilder is used, which is a software tool developed for the Dutch Ministry of Social Affairs and Employment [1]. Both agencies have provided data on accidents reported to and investigated by the labor inspectorate. In both databases, the type of equipment involved in the accidents can be selected. This equipment classification is based on the classification by ESAW (European Statistics on Accidents at Work). Pallet movers fall under the code 11.04 ('mobile handling devices, handling trucks (powered or not)—barrows, pallet trucks, etc.'). It should be noted that the data obtained does not only cover accidents with pallet movers, but also other equipment falling under the same code. Hence, national numbers of pallet mover accidents cannot be given. However, the databases also contain information on types of accident scenarios, root causes, and failing safety barriers. The latter qualitative information was used to complement the development of the bow-ties.

Documents and data concerning pallet mover safety available at the Belgian plant (and by extension at all European plants if available) were analyzed: The material of the pallet mover training (presentation, syllabus), an observation checklist used to evaluate the use of pallet movers (HSEQ staff and supervisors use this checklist to evaluate the behavior of operators during pallet mover use), the minutes of monthly safety meetings, a pallet mover maintenance checklist, the most recent pallet mover inspection overview, a checklist for interims regarding pallet mover use, and the safety notifications regarding pallet movers in the incident registration system. During 2015–2016, 127 safety notifications regarding pallet movers were available at the Belgian plant comprising information on accidents (*n* = 9), near-misses (*n* = 9), unsafe conditions (*n* = 93), and positive feedback to the operators (*n* = 16). All available accident analyzes (the 6W-2H and why-why techniques) performed after a recordable accident with a pallet mover were also taken into account. In Appendix A, an example of such a recordable accident is given, containing a short description of the accident and the actions taken in response to the accident.

At the Belgian plant, observations were being held at the workplaces of the pallet mover operators. A personal introduction of the researchers and the purpose of the study were given before the observations, and an introduction was given to the contractors during their daily team meetings. Observations were complemented with interviews with operators (*n* = 25), team leaders (*n* = 5), the HSEQ staff (*n* = 3), and management (*n* = 2). Interviews with operators and team leaders were performed on-the-job and took approximately fifteen minutes per person. The following aspects were addressed during the interviews:


Interviews with the HSEQ staff and management were performed in a meeting room and took approximately one hour per person, discussing topics as the safety management system and findings during the fieldwork. The staff of the external company that provides the training of the pallet mover operators was also interviewed.

#### **4. The Bow-Tie Model**

The safety metaphor used in this study is the so-called bow-tie (Figure 3). The bow-tie model originates from the engineering domain and combines a hazard and safety barrier concept, dating as far back as DeBlois (1926), Gibson (1961) and Haddon (1963), together with a scenario concept, known from the Swiss cheese model of Reason (1997) [2–8]. A bow-tie model is comprised of a fault tree (the left-hand side of the model), which represents the risk factors of a failure, and an event tree (the right-hand side of the model), which represents the consequences of a failure [9].

The bow-tie metaphor illustrates an accident process, starting with a hazard on the left-hand side. A hazard (or energy) is a source or a condition with the potential for causing harm. Various accident scenarios, pictured as left-right arrows, can migrate to the center point of the metaphor, the central event. This central event represents a state where the hazard (energy) has become uncontrollable and, thus, becomes an undesirable event with a potential for harm or damage. The central event proceeds the consequences at the right-hand side of the metaphor, such as causing harm to people or damage to assets or environment.

The strength of the metaphor is its relationship between accident scenarios, technical safety barriers, non-technical safety barriers, and management delivery systems. A scenario is a sequence of events and conditions necessary for an accident to occur. Looking at the scenarios, two types

of events can be distinguished. There are pre-event accident scenarios presented at the left-hand side of the central event (leading to the central event), and there are post-event accident scenarios depicted at the right-hand side of the central event (leading to the consequences). The technical safety barriers, represented as the black boxes in the scenarios, are technical entities that can interrupt the accident scenario. An example of a technical safety barrier is an emergency stop on a pallet mover. The non-technical (or organizational and human) safety barriers are represented as the white boxes in the scenarios, being non-technical entities that can interrupt the accident scenario. An example of a non-technical safety barrier is the removal of leaking cubitainers (which interrupts the pre-event accident scenario of losing control over the pallet mover due to leaked products on the floor). The upwards arrows in Figure 3 represent the influence of management delivery systems. Management delivery systems influence the quality (in terms of reliability and availability) of the technical and non-technical safety barriers. For example, maintenance of the emergency stop on the pallet mover does not interrupt the accident scenario in a direct way, but is a management delivery system influencing the reliability of the technical safety barrier 'emergency stop on pallet mover'. Another example of a management delivery system is the training of pallet mover operators on removing leaking cubitainers, which influences the reliability of the non-technical safety barrier 'removal of leaking cubitainers'.

There are two types of safety barriers that can be distinguished. There are safety barriers to prevent the occurrence of the central event, which are presented in the pre-event accident scenarios, and there are safety barriers to control or to mitigate the consequences, which are presented in the post-event accident scenarios.

The bow-tie model has a hidden time factor. Less than adequate safety barriers or management delivery systems can be manifested over a long period of time. If a hazard becomes uncontrollable and reaches the central event, scenarios reaching their consequences will usually unroll very quickly. Pre-event accident scenarios may take days, week, months, or even longer, while post-event accident scenarios develop in hours, minutes, or even shorter.

After bow-ties are developed, the next step is to assign indicators to the safety barriers and the management delivery systems [10]. Indicators are able to visualize possibilities for improvement, to indicate safety improvement or safety decline over time, and create benchmarking (e.g., between different plants). Once the indicators are developed, targets and limits should be assigned to every indicator (what is acceptable or unacceptable as a result or for instance tolerable with leeway for improvement). Additionally, responsibilities have to be set up in order to achieve goals and to define actions when targets are not met. According to the needs of the company, indicators can be prioritized (which indicators are for instance more important or more feasible to implement).

Traditionally, the scope of accident and incident investigations, whether performed internally or externally, is usually limited to investigating the immediate causes and decision making processes related to the accident sequence. Important factors contributing to the accident are hereby often overlooked. However, since the method used to analyze incident data and accident information influences the proposed prevention measures, it should be of no surprise that those investigations don not directly guide one towards the most effective improvements and solutions. On the other extreme, methods and models to investigate the socio-technical system, such as those proposed by Rasmussen ('drift to danger' model) [11], Leveson (the STAMP method) [12] or Hollnagel (the FRAM method) [13], are often too general for the application intention, and this way surpass their goal. The bow-tie method as employed in this research finds a way between both situations, and thoroughly investigates a (possible) accident without being too high-level.

The majority of accident modeling techniques has been designed to address process safety. However, most of these models tend to be also applicable to the field of occupational safety [14]. The same applies for the bow-tie model, which has entered the field of occupational safety through the European Workgroup for development of the Occupational Risk Model (WORM), which started with the aim of decreasing the occupational accident rate in the Netherlands by 10–15% [14,15]. The value of this model lies mainly in its suitability for qualitative analysis. In addition, bow-ties have

been proposed for quantifying occupational risk in the framework of the WORM research project. An initial [16] and a more general form of the model have been presented in Reference [17]. Bowties for quantifying occupational risk have been presented in the following cases: Falls from heights [18], falling objects [19], contact with moving parts of machines [20], activities near moving vehicles [21], fires [22] and hazardous substances [23].

**Figure 3.** The bow-tie model.

#### **5. Results**

#### *5.1. The Outcomes of the Current Accident Analysis in the Plant under Investigation*

At the Belgian plant, pallet mover accidents are being analyzed with the 6W-2H and why-why techniques. This accident analysis allows us to focus on technical, organizational and human aspects. However, in the accident analysis of the plant, a trend of 'blaming the victim' can be identified. For example, looking at the pallet mover accident as described in the Appendix A, the following aspects can be indicated as important contributors for the accident: The area was very crowded creating a narrow maneuvering space, the load that had to be picked up was not standing in the designated zone and the production pressure was high. The accident analysis shows that the involved operator was personally blamed, as disciplinary measures against the operator were taken by the contractor company.

The countermeasures that are taken based on the results of the accident analysis are also mainly directed towards the operators, such as giving personal warnings and the retraining of pallet mover operators. The observation checklist to evaluate the behavior of operators during the use of pallet movers is often used after an incident occurred, meaning that it is implicitly assumed that the behavior of the operator is one of the root causes of incidents. Organization-oriented countermeasures mainly focus on the adaptation of the working environment to create more maneuvering space and a better overview.

### *5.2. Bow-Ties of Accident Processes with Pallet Movers*

Table 1 presents an overview of the left side of the bow-tie: Possible hazards, pre-event accident scenarios, preventing technical and non-technical safety barriers, preventing management delivery systems, and central events of accident processes with pallet movers. Table 2 comprises central events, mitigating technical and non-technical safety barriers, mitigating management delivery systems, post-event accident scenarios, and consequences.

Tables 1 and 2 were composed based on the findings of the literature study [24–40], information available through Belgian and Dutch national accident databases, the analysis of documents and data available at the Belgian plant regarding pallet movers, and the results of the fieldwork (observations and interviews).

**Table 1.** The elements on the left-hand side of the bow-ties of accident processes with pallet movers based on: (1) Literature; (2) Belgian and Dutch Nationaldata; (3) Document analysis; (4) Safety notifications in the incident registration system of the Belgian plant; (5) Accident analysis; (6) Fieldwork: Observationsand interviews. **Hazard Pre-Event Accident Scenario Preventing Technical and Non-Technical Safety Barriers and Management Delivery Systems Central Event** • Limited sight due to height of load (1,2,3,5,6) • Camera on pallet mover (1) • Mirror in workplace (1,2,6) • Traffic management: floor markings (1,2,3,5,6) • Use horn on pallet mover (1,2,3,4,5,6) • clothing employees with reflective clothing (2)






•


**2.**Theelementstheright-handsideofthebow-tiesoftheaccidentwithpalletbasedthe(1)Literature;(2)BelgianandDutch

#### **6. Assigning Indicators to the Bow-Ties**

Once the bow-ties are composed, they are an excellent point of departure to assign indicators to the technical and non-technical safety barriers and to the management delivery systems in order to control (i.e., prevent or mitigate) the accident scenarios. Indicators can support a company's safety management and provide information on a preferred safety goal.

It is important that the indicators focus on aspects that are applicable to the operating environment. For instance, it could be an improvement to replace all present pallet movers with new, less heavy equipment. However, in the context of the company, it is possible that this is not feasible due to budgetary constraints. Another example is the reorganization of the layout of the floors, which is an important aspect in order to create more maneuvering space. However, in the plant under investigation, installations are integrated into an existing space which was initially not designed for that purpose, leading to space constraints. Additionally, in the past years, several improvements have already been made regarding the layout of the working space and the work floor, and there is, of course, a limitation to the possibilities in creating more maneuvering space. A question arising from this space constraint is whether pallet movers are the best equipment to use at particular spaces in a production facility with limited maneuvering space and if it would not be better to search for an alternative way to transport the material. This is related to the inherent safety of a company [41], which will be discussed at the end of this section.

Besides the applicability of indicators in the company environment, the focus of the indicators can also be chosen based on the presence of management delivery systems. For instance, as can be seen in Tables 1 and 2, certain management delivery systems are present in multiple scenarios. It concerns the following management delivery systems: 'training of pallet mover operators', 'sensitization and communication', 'guidelines and procedures', and 'planning of production and staffing'. Indicators assigned to these management delivery systems can be considered as general indicators, as they are linked to multiple accident scenarios. As an example, the management delivery systems 'training of pallet mover operators' is further elaborated below.

Next to the general indicators, scenario-specific indicators can also be developed. Decisions on what scenarios should be focused on can be based on the plant-specific risks regarding pallet mover use. Two examples of company-specific pre-scenarios will be further elaborated below, being 'narrow maneuvering space' and 'leaking cubitainers'.

#### *6.1. General Indicators: Training of Pallet Mover Operators*

In Table 3, the possible indicators for the frequently occurring management delivery system 'training of pallet mover operators' have been elaborated. An indicator of the content of the (re)training is proposed, and an indicator of the quality control of the (re)training. Additionally, there are indicators regarding the coverage ratio of the training and the retraining.


**Table 3.** Possible indicators for the management delivery system 'training of pallet mover operators'.

It should be noted that a certain sequentiality is present in the follow-up of the indicators. For instance, a high coverage ratio of the (re)training is negligible if the content of the (re)training is not tailored to the needs of the company and if the quality of the (re)training is evaluated as substandard.

#### *6.2. Scenario-Specific Indicators: Narrow Maneuvering Space*

A specific risk at the plant under investigation is the narrow maneuvering space. Therefore, this scenario was chosen to be further elaborated into scenario-specific indicators. Figure 4 shows the bow-tie of the pre-event accident scenario of a narrow maneuvering space. Only a selection of possible safety barriers and management delivery systems has been included in the bow-tie. Two non-technical safety barriers have been included: 'no pallet mover use at too narrow spaces' and 'correct pallet mover use at narrow spaces'. One technical safety barrier has been included: 'sandblasting floor'. Sandblasting of the transportation routes with pallet movers (Figure 5) leads to a better grip and a shorter breaking distance. The following management delivery systems have been included: 'traffic management' and 'training pallet mover operators'.

**Figure 4.** The possible indicators for the pre-scenario of 'narrow maneuvring spaces'.

**Figure 5.** An example of a sandblasted and not sandblasted pallet mover transportation route.

As with the general indicators, a sequentiality is also present in the follow-up of the scenariospecific indicators. For example, when a company does not include correct pallet mover use at narrow maneuvering spaces in the training, it does not make sense to evaluate non-compliances on this topic.
